Privacy notice
SmartCampus is the school management system used by your school to run classes, attendance, assessments and student records. This notice explains what personal data the system holds, why, and who can see it. It is written with the Malaysian Personal Data Protection Act 2010 (PDPA) in mind.
1. Who is responsible
Your school is the data user for the records kept in SmartCampus. SmartCampus operates the system on the school's behalf. Questions about your data go to your school administrator, or through the support link on the sign-in page.
2. What we collect
- Account details: name, email address, role (admin, teacher, student or parent), class, and student or IC number where the school provides it.
- School records: attendance, timetable, assignments and results, quiz and exercise attempts.
- Welfare records: discipline reports, merit and demerit points, warning letters, and medical certificate (MC) submissions, which may reveal health information.
- Technical data: sign-in time, IP address, browser type, and device tokens for push notifications. Staff actions on sensitive records are written to an audit log.
3. Why we use it
- To run the school day: timetables, attendance, marking and reporting.
- To look after students: follow up on absence and conduct, and inform parents or guardians.
- To keep the system safe: detect misuse, investigate incidents and keep a record of who changed what.
We do not sell personal data and we do not use it for advertising.
4. Who can see it
- Teachers see the classes and students they teach or manage.
- Administrators see records needed to run the school.
- Parents see their own child's records. Students see their own records.
Data is shared outside the school only where the law requires it.
5. How it is protected
- Traffic is encrypted with HTTPS, and passwords are stored hashed, never in plain text.
- Access is limited by role. Staff accounts can turn on two-factor sign-in, and repeated failed sign-ins are blocked.
- Sensitive actions are recorded in an audit log, and the database is backed up regularly.
6. How long we keep it
Records are kept while the student is enrolled and for as long afterwards as the school needs them for its legal and administrative duties. Your school decides the retention period and can ask for records to be removed.
Technical data is cleared automatically every night: read notifications after 180 days, unread ones after 365 days, the IP address and browser details in the audit log after 180 days (the entry itself after 2 years), and expired sign-in tokens soon after they expire.
7. Your rights
You can ask to see the personal data held about you or your child, and to correct anything that is wrong. Contact your school administrator, who can act on the request or pass it to us.
8. Cookies
SmartCampus uses only the cookies it needs to work: a session cookie that keeps you signed in and a security token that protects forms. There are no advertising or tracking cookies.
9. Changes
If this notice changes, the date at the top is updated. Significant changes are announced to schools.